7.2. Installing an IdM server with an integrated CA with keys and certificates stored on an HSM

Procedure

1. Run the install command, ensuring you specify the location of the PKCS #11 library, the token name, and the token password:

   ipa-server-install -a <password> -p <dmpassword>-r <IDM.EXAMPLE.COM> -U --setup-dns --allow-zone-overlap --no-forwarders -N --auto-reverse --random-serial-numbers -–token-name=<HSM-TOKEN> --token-library-path=/opt/nfast/toolkits/pkcs11/libcknfast.so

2. Specify the token password when prompted.

Verification

1. Run certutil to display CA certificate information:

   certutil -L -d /etc/pki/pki-tomcat/alias
   
   Certificate Nickname                    Trust Attributes
                                           SSL,S/MIME,JAR/XPI
   
   caSigningCert cert-pki-ca               CT,C,C
   ocspSigningCert cert-pki-ca             ,,
   Server-Cert cert-pki-ca                 u,u,u
   subsystemCert cert-pki-ca               ,,
   auditSigningCert cert-pki-ca            ,,P

   Note that where there is no u listed under Trust Attributes for a certificate, it indicates the private keys are stored on the token. In this case, only the Server-Cert cert-pki-ca has the u flags as it is not installed on the HSM for performance reasons.

2. Verify that the keys and certificates are stored on the HSM:

   certutil -L -d /etc/pki/pki-tomcat/alias -h <HSM-TOKEN>
   
   Certificate Nickname                                Trust Attributes
   	   SSL,S/MIME,JAR/XPI
   
   Enter Password or Pin for "<HSM-TOKEN>":
   <HSM-TOKEN>:subsystemCert cert-pki-ca                  	u,u,u
   <HSM-TOKEN>:ocspSigningCert cert-pki-ca                	u,u,u
   <HSM-TOKEN>:caSigningCert cert-pki-ca                  	CTu,Cu,Cu
   <HSM-TOKEN>:auditSigningCert cert-pki-ca               	u,u,Pu

   The certificate name is prefixed with the HSM token name, which indicates that the private keys and certificates are stored on the token.

   Where the keys are stored does not affect how users obtain or use certificates.